CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1250)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated SQL Injection
Podlove Podcast Publisher
<3.5.6Update to 3.5.6
- Medium5.4Contributor+ Stored Cross-Site Scripting
WP Video Lightbox
≤1.9.2Update to 1.9.3
- Medium6.1Stored Cross-Site Scripting
Limit Login Attempts
<4.0.50Update to 4.0.50
- Critical9.1Unauthenticated Path Traversal in REST API
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.3Update to 4.5.4
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcodes Ultimate – Content Elements
<5.10.2Update to 5.10.2
- Medium5.4Author+ Stored Cross-Site Scripting
Timetable and Event Schedule by MotoPress
≤2.3.18Update to 2.3.19
- Medium4.3Arbitrary Comment Deletion via Cross-Site Request Forgery
Comment Link Remove and Other Comment Tools
≤2.1.4Update to 2.1.6
- Medium6.5Arbitrary User's Hashed Password/Email/Username Disclosure
Timetable and Event Schedule by MotoPress
≤2.3.19Update to 2.4.0
- Medium6.4Unauthorised Event TimeSlot Update
Timetable and Event Schedule by MotoPress
≤2.4.1Update to 2.4.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via blockType arguments
Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts
<3.0.3Update to 3.0.3
- High8.1Subscriber+ Arbitrary File/Folder Deletion
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.3Update to 4.5.4
- Medium4.8Authenticated Stored Cross-Site Scripting
Post Views Counter
≤1.3.4Update to 1.3.5
- Medium4.3Unauthorised Event TimeSlot Deletion
Timetable and Event Schedule by MotoPress
≤2.4.1Update to 2.4.2
- High7.2Authenticated (Admin+) Arbitrary File Upload
Simple Schools Staff Directory
≤1.1No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
SimpLy Gallery
<2.2.1Update to 2.2.1
- High7.2Authenticated SQL Injection via product_id Parameter
Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More
<3.3.1.0Update to 3.3.1.0
- High8.8Authenticated (Admin+) SQL Injection
WordPress Page Contact
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
MicroCopy
≤1.1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Display Users
≤2.0.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
The Sorter
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
GSEOR – WordPress SEO Plugin
≤1.3No patch available
- High7.2Authenticated (Admin+) SQL Injection
WP iCommerce – the first interactive ecommerce for wordpress
≤1.1.1No patch available
- High8.8Authenticated (Admin+) SQL Injection
WP-Board
≤1.1(Beta)No patch available
- High7.2Authenticated (Admin+) SQL Injection
RESPONSIVE 3D SLIDER
≤1.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
WP Domain Redirect
≤1.0No patch available
- Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting
博客社交分享组件
≤1.4.4Update to 1.4.5
- Medium5.4Cross-Site Scripting
Gutenslider – Image & Video Slider Block
<5.2.0Update to 5.2.0
- Medium5.4Unauthorised AJAX Calls
Visual Link Preview
<2.2.3Update to 2.2.3
- High8.1Cross-Site Request Forgery
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
≤3.4.1Update to 3.4.2
- Medium6.4Stored Cross-Site Scripting
ThinkTwit
<1.7.1Update to 1.7.1